CVE-2026-69080 - Apache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE ID :CVE-2026-69080
Published : Oct. 16, 2026, 8:17 p.m. | 39 minutes ago
Description :Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-69080
Published : Oct. 16, 2026, 8:17 p.m. | 39 minutes ago
Description :Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96620 - Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
CVE ID :CVE-2026-96620
Published : Oct. 16, 2026, 8:18 p.m. | 38 minutes ago
Description :Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
Severity: 9.2 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96620
Published : Oct. 16, 2026, 8:18 p.m. | 38 minutes ago
Description :Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
Severity: 9.2 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96542 - EA Javelin Anticheat Installer Local Privilege Escalation
CVE ID :CVE-2026-96542
Published : Oct. 16, 2026, 9:21 p.m. | 1 hour, 54 minutes ago
Description :Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96542
Published : Oct. 16, 2026, 9:21 p.m. | 1 hour, 54 minutes ago
Description :Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-17591 - Libarchive: libarchive: use-after-free via aliased mac metadata copy
CVE ID :CVE-2026-17591
Published : Oct. 16, 2026, 10:03 p.m. | 1 hour, 12 minutes ago
Description :A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
Severity: 3.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-17591
Published : Oct. 16, 2026, 10:03 p.m. | 1 hour, 12 minutes ago
Description :A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
Severity: 3.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-111802 - Nautilus: nautilus: arbitrary file deletion via trash symlink
CVE ID :CVE-2026-111802
Published : Oct. 16, 2026, 10:03 p.m. | 1 hour, 12 minutes ago
Description :A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
Severity: 6.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-111802
Published : Oct. 16, 2026, 10:03 p.m. | 1 hour, 12 minutes ago
Description :A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
Severity: 6.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110752 - Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
CVE ID :CVE-2026-110752
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110752
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110753 - Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
CVE ID :CVE-2026-110753
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110753
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110754 - Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
CVE ID :CVE-2026-110754
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110754
Published : Oct. 16, 2026, 10:06 p.m. | 1 hour, 9 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110755 - Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
CVE ID :CVE-2026-110755
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 8 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110755
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 8 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110756 - Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
CVE ID :CVE-2026-110756
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 8 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110756
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 8 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110757 - Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine
CVE ID :CVE-2026-110757
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value validated as a number can end the record early and turn the fields after it into a separate row.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110757
Published : Oct. 16, 2026, 10:07 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value validated as a number can end the record early and turn the fields after it into a separate row.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110758 - Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
CVE ID :CVE-2026-110758
Published : Oct. 16, 2026, 10:08 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110758
Published : Oct. 16, 2026, 10:08 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110759 - Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
CVE ID :CVE-2026-110759
Published : Oct. 16, 2026, 10:08 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110759
Published : Oct. 16, 2026, 10:08 p.m. | 1 hour, 7 minutes ago
Description :Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108372 - LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
CVE ID :CVE-2026-108372
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108372
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-111044 - Disabled Sunshine clients can bypass revocation with a derived client certificate
CVE ID :CVE-2026-111044
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-111044
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-49410 - OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
CVE ID :CVE-2026-49410
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-49410
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62438 - Gimp: gimp: paa integer overflow out-of-bounds read
CVE ID :CVE-2026-62438
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62438
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62439 - Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
CVE ID :CVE-2026-62439
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62439
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-68498 - jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
CVE ID :CVE-2026-68498
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-68498
Published : Oct. 16, 2026, 10:17 p.m. | 58 minutes ago
Description :StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96626 - Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
CVE ID :CVE-2026-96626
Published : Oct. 16, 2026, 10:18 p.m. | 56 minutes ago
Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96626
Published : Oct. 16, 2026, 10:18 p.m. | 56 minutes ago
Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96627 - Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
CVE ID :CVE-2026-96627
Published : Oct. 16, 2026, 10:18 p.m. | 56 minutes ago
Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96627
Published : Oct. 16, 2026, 10:18 p.m. | 56 minutes ago
Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...